From a 25-Minute Sweep to a Multi-Wave Incident

The 594 BTC transfer became the headline because of its speed and coordination. Reporting on the first wave said approximately 562 BTC was subsequently consolidated into one address. The pattern suggested automation: many old, single-signature outputs were swept in close succession, with the attacker apparently taking the entire available balance rather than behaving like an ordinary wallet user.

The loss estimate did not stop there. Galaxy Research head Alex Thorn continued tracing transactions with a similar shape. By August 2, his observed estimate for three attack waves had reached 1,367.05 BTC across 4,585 source addresses, worth about $88.6 million using the contemporaneous price reference in his update.

On August 3, Thorn flagged another cluster between Bitcoin blocks 960,778 and 960,792. The initial review found 218 transactions moving more than 380 BTC from 462 suspected victim addresses to 210 new destinations. Later reporting based on his analysis expanded the potential cluster to approximately 448.7 BTC across 709 addresses.

That fourth cluster requires careful language. Some transactions were still pending with replace-by-fee enabled, which meant a victim could theoretically replace a malicious unconfirmed transaction by offering a higher fee. Thorn described the pattern as likely another Coldcard wave, not as a final adjudicated loss figure. Adding 448.7 BTC mechanically to the prior total produces about 1,815.75 BTC, but that is a potential four-wave exposure estimate, not a settled theft total.

The attack-wave count matters, but it is not the deepest part of the story. The harder question is how an attacker could control wallets whose private keys were supposed to have remained offline.

The 2021 Code Change That Weakened Seed Generation

A Bitcoin wallet seed is not merely a list of words. It is a human-readable representation of secret entropy from which the wallet derives private keys. If that entropy is produced correctly, guessing the seed is computationally unrealistic. If the possible inputs are sharply constrained, the same words can look perfectly ordinary while providing much less security.

Block's Bitcoin Engineering and Security team traced the Coldcard problem to a change introduced during a 2021 cryptographic-library migration. Coldcard moved seed generation from ckcc.rng_bytes(), which reached the board's hardware random-number generator, to ngu.random.bytes().

The Wrong Generator Behind the Right Interface

The device configuration defined MICROPY_HW_ENABLE_RNG as zero because Coldcard supplied a separate hardware-RNG wrapper. A library guard checked whether that macro was defined, rather than whether it was enabled. Because the macro existed, the build succeeded. But the function call resolved to MicroPython's Yasmarang software fallback instead of the intended hardware source.

That fallback initialized itself from values including part of the microcontroller's unique identifier and timer registers. Those inputs can vary, but they are device metadata and timing state, not fresh cryptographic randomness. Once the relevant state and the number of prior generator calls are known or sufficiently constrained, the resulting stream is deterministic.

For affected Mk2 and Mk3 firmware, Block found no cryptographically generated secret being added through this path. Coinkite's preliminary attack model estimated an effective search space of about 40 bits. Block presented a more conditional analysis: the practical search depends on knowledge of the device identifier, timers and call history, and it did not claim a complete end-to-end brute-force benchmark.

Later Mk4, Q and Mk5 devices mixed secure-element material into the generator, reducing the severity but not restoring the intended security margin. Block found that only four bytes of a digest reached the reseed function for a fixed fallback state and call history, leaving at most 2^32 securely distinguished output streams under that condition. Coinkite estimated roughly 72 bits of effective search space under its broader attack assumptions. The figures describe different models, but both analyses reach the same operational conclusion: the later devices were less exposed than the affected Mk2 and Mk3 generation, yet still required remediation.

Why Hashing Could Not Restore the Missing Entropy

Coldcard hashed the generated 32-byte value before turning it into wallet material. That can make output appear statistically uniform, but a hash cannot create possibilities that were absent from its input. If a generator can produce only a limited family of candidate values, hashing those values produces only the same number of candidate seeds.

The same principle applies to the BIP-39 checksum. It helps detect transcription errors; it does not add secret randomness. A valid-looking 12- or 24-word phrase can therefore be cryptographically weak if the process that selected it was predictable.

How an Offline Wallet Could Be Emptied

The public blockchain gave the attacker something valuable: a validation target. Bitcoin addresses, public keys revealed by prior spending and extended public keys shared with wallet software can all help determine whether a guessed private key or seed belongs to a target wallet.

A plausible attack would generate candidate RNG states, derive the corresponding seed and addresses, and compare them with funded addresses on-chain. When a candidate matched, the attacker would possess the same signing authority as the owner. The actual Coldcard would not need to communicate with the attacker at any point.

This explains how cold storage and theft can coexist. The wallet remained offline, but its secret may have been reproducible elsewhere.

The exact operational recipe remains unknown. Block said practical cost depends on information such as the device UID, boot timing, previous RNG calls and key-derivation work. Its researchers had not completed full empirical exploit testing when they published the advisory. No authoritative account has established how the attacker obtained or constrained every required input, what hardware was used, or whether more than one actor participated.

Coinkite speculated that an attacker may have used artificial intelligence to inspect historical open-source firmware. That possibility is not evidence of attribution. The code was public for years, and both traditional review and AI-assisted review could have uncovered it. The defensible conclusion is that the vulnerability was discoverable from source code, not that AI has been proven to be the attacker's method.

Which Coldcard Wallets Were Affected

Block dated the vulnerable generation path to firmware 4.0.0 in March 2021. Coinkite's user advisory defines the affected Mk2/Mk3 release range as versions 4.0.1 through 4.1.9 inclusive. For later devices, Coinkite warned that seeds generated on Mk4 and Mk5 before standard firmware 5.6.0, or Q before 1.5.0Q, were also affected. Separate Edge release tracks required 6.6.0X for Mk4/Mk5 and 6.6.0QX for Q.

Exposure follows the firmware used when the seed was generated, not the firmware installed today. Updating a device changes future generation behavior; it does not alter an existing seed.

Coinkite identified two independent protections that could materially change a particular wallet's exposure. At least 50 fair, private and independent dice rolls added during original seed creation supplied at least 128 bits of independent entropy, according to the company. A strong, unique BIP-39 passphrase also creates a separate barrier an attacker must overcome. Neither a short passphrase nor the device PIN should be treated as an equivalent protection.

Multisignature arrangements need equally careful treatment. A vulnerable Coldcard key does not automatically defeat a wallet that still requires signatures from enough independently secure devices. But a quorum composed entirely of vulnerable seeds can preserve the same underlying problem. The protection comes from an adequate threshold of independently generated, secure keys, not from the multisig label alone.

Coinkite's Fix and the Migration Problem

Coinkite released hotfixes across the affected product lines and told users not to generate replacement seeds until the appropriate fixed firmware was installed. The company's guidance is unambiguous on the most important point: firmware updates cannot repair seeds created by the faulty process.

Users with affected seeds must create an entirely new seed on fixed firmware, verify the new wallet fingerprint and receive address, send a small test transaction, and only then migrate the remaining balance. The old backup should remain available until the transfer is fully confirmed. Rushing that process can introduce a new loss through an incorrect address, incomplete backup or passphrase mistake.

TAPSIGNER, OPENDIME and SATSCARD are not affected because they use different codebases. That limitation is important. The incident is serious, but it is not evidence that every Coinkite product or every hardware wallet shares the same vulnerability.

What the Coldcard Failure Changes About Cold Storage

"Cold" describes a wallet's relationship with networks. It does not certify how its private keys were created, whether its firmware followed the intended execution path, or whether the backup and passphrase were handled safely.

The Coldcard failure exposed a gap between component review and system behavior. The intended hardware RNG code existed in the firmware binary. The software fallback also had the expected function signature. Previous review verified that the good component was present, but did not confirm which implementation wallet generation actually reached across the integrated libraries.

That is a sobering lesson for open-source security. Public code enables independent verification, but publication is not the same as continuous end-to-end review. Security-critical builds need tests that confirm entropy reaches the caller, fail closed when the intended source is unavailable, and measure the behavior of compiled artifacts rather than assuming source-level intent survives integration.

For users, the lesson is not to abandon self-custody. It is to understand that self-custody transfers responsibility across several layers: hardware authenticity, firmware provenance, seed entropy, passphrase strength, backup isolation, multisig diversity and the ability to migrate safely when a defect is discovered.

The first 594 BTC disappeared in minutes. The conditions that made those transfers possible may have existed for more than five years. That time gap is the central warning: a cold wallet can remain silent and apparently secure for years while a weakness in its original seed waits to be discovered.

Trade Bitcoin With Leverage - Without Giving Up Custody

Decentralized perpetual exchanges have moved well past niche status. According to CoinGecko's 2025 Annual Crypto Industry Report, DEX perpetual trading volume surged 346% last year to $6.7 trillion, while centralized exchange open interest fell 20.8% over the same period. Traders are committing serious capital to on-chain derivatives, and the reasons are straightforward: counterparty risk is real, custodial failures happen, and censorship resistance matters.

edgeX is a decentralized perpetual futures exchange built for traders who want market access without sacrificing control.

Why Traders Choose edgeX for BTC Perpetuals

• No KYC, no barriers. Connect a wallet and start trading without identity verification or account approvals.
• True self-custody. edgeX combines off-chain order matching with verifiable on-chain settlement secured by Ethereum. Forced-withdrawal mechanisms keep funds recoverable directly from the blockchain even if the operator goes offline.
• Deep liquidity, tight spreads. edgeX maintains $10 million of market depth within a one-basis-point spread, with sub-0.1-basis-point slippage on trades exceeding $100,000.
• Up to 100x leverage. Traders can scale positions to match their risk framework, whether they are hedging exposure or trading momentum.
• 100% trading fee rewards. Active traders can earn rewards on their trading activity, reducing the net cost of high-frequency strategies over time.
• Institutional-grade infrastructure. edgeX processes up to 200,000 orders per second with matching latency below 10 milliseconds.

Put Your Bitcoin Market View to Work

Trade BTC/USDC perpetual futures on edgeX while retaining control of your assets. Leverage magnifies both gains and losses, so position sizing, liquidation distance and funding costs remain essential parts of risk management.

Frequently Asked Questions

Did hackers remotely access Coldcard devices?

No authoritative investigation has shown remote access to the affected devices. The reported mechanism involves reconstructing candidate seeds or private keys offline from a weakened random-number process and validating them against public blockchain information.

Did the incident break Bitcoin encryption?

No. The vulnerability concerned wallet seed generation in affected Coldcard firmware. Bitcoin's underlying signature system was not shown to have been cryptographically broken.

Does installing the newest firmware protect an existing wallet?

It protects future seed generation on the fixed release, but it cannot repair a seed created on affected firmware. Coinkite advises generating a new seed and moving the funds after carefully verifying the replacement wallet.

Were all Coldcard models equally vulnerable?

No. Affected Mk2/Mk3 firmware used the most severe path. Mk4, Q and Mk5 added secure-element entropy and were assessed as less exposed, but Coinkite still classified affected pre-fix seeds as serious enough to require migration. Product, firmware track and seed-creation date all matter.

Is 1,815.75 BTC the confirmed amount stolen?

No. Galaxy Research's three-wave observed estimate was 1,367.05 BTC. Approximately 448.7 BTC was associated with a likely fourth wave, but some transactions were pending or replaceable while the cluster was being analyzed. The combined figure is a provisional exposure estimate, not a final confirmed loss total.